[PATCH v1] clk: microchip: mpfs-ccc: fix peripheral driver registration failures after oob fix

[PATCH v1] clk: microchip: mpfs-ccc: fix peripheral driver registration failures after oob fix

[Conor Dooley]

From: Conor Dooley <conor.dooley@microchip.com>

Commit 2f7ae8ab6aa73 ("clk: microchip: mpfs-ccc: fix out of bounds
access during output registration") fixed the out of bounds access, but
it did so by packing sparse indices into a linear space. When
peripheral drivers request clocks, they obviously don't care for this
compression and use the sparse indices, and therefore try to request the
wrong clocks or clocks that don't exist.

The most straightforward fix here seems to stop being clever with the
packing and just overallocate the array.

Fixes: 2f7ae8ab6aa73 ("clk: microchip: mpfs-ccc: fix out of bounds access during output registration")
Fixes: d39fb172760e ("clk: microchip: add PolarFire SoC fabric clock support")
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
---
CC: Daire McNamara <daire.mcnamara@microchip.com>
CC: Michael Turquette <mturquette@baylibre.com>
CC: Stephen Boyd <sboyd@kernel.org>
CC: Brian Masney <bmasney@redhat.com>
CC: Claudiu Beznea <claudiu.beznea@tuxon.dev>
CC: linux-riscv@lists.infradead.org
CC: linux-clk@vger.kernel.org
CC: linux-kernel@vger.kernel.org
---
 drivers/clk/microchip/clk-mpfs-ccc.c | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/drivers/clk/microchip/clk-mpfs-ccc.c b/drivers/clk/microchip/clk-mpfs-ccc.c
index 0a76a1aaa50f7..40c17593e5941 100644
--- a/drivers/clk/microchip/clk-mpfs-ccc.c
+++ b/drivers/clk/microchip/clk-mpfs-ccc.c
@@ -32,6 +32,7 @@
 #define MPFS_CCC_FIXED_DIV		4
 #define MPFS_CCC_OUTPUTS_PER_PLL	4
 #define MPFS_CCC_REFS_PER_PLL		2
+#define MPFS_CCC_NUM_CLKS		16
 
 struct mpfs_ccc_data {
 	void __iomem **pll_base;
@@ -178,7 +179,7 @@ static int mpfs_ccc_register_outputs(struct device *dev, struct mpfs_ccc_out_hw_
 			return dev_err_probe(dev, ret, "failed to register clock id: %d\n",
 					     out_hw->id);
 
-		data->hw_data.hws[out_hw->id - 2] = &out_hw->divider.hw;
+		data->hw_data.hws[out_hw->id] = &out_hw->divider.hw;
 	}
 
 	return 0;
@@ -231,17 +232,9 @@ static int mpfs_ccc_probe(struct platform_device *pdev)
 {
 	struct mpfs_ccc_data *clk_data;
 	void __iomem *pll_base[ARRAY_SIZE(mpfs_ccc_pll_clks)];
-	unsigned int num_clks;
 	int ret;
 
-	/*
-	 * If DLLs get added here, mpfs_ccc_register_outputs() currently packs
-	 * sparse clock IDs in the hws array
-	 */
-	num_clks = ARRAY_SIZE(mpfs_ccc_pll_clks) + ARRAY_SIZE(mpfs_ccc_pll0out_clks) +
-		   ARRAY_SIZE(mpfs_ccc_pll1out_clks);
-
-	clk_data = devm_kzalloc(&pdev->dev, struct_size(clk_data, hw_data.hws, num_clks),
+	clk_data = devm_kzalloc(&pdev->dev, struct_size(clk_data, hw_data.hws, MPFS_CCC_NUM_CLKS),
 				GFP_KERNEL);
 	if (!clk_data)
 		return -ENOMEM;
@@ -255,7 +248,7 @@ static int mpfs_ccc_probe(struct platform_device *pdev)
 		return PTR_ERR(pll_base[1]);
 
 	clk_data->pll_base = pll_base;
-	clk_data->hw_data.num = num_clks;
+	clk_data->hw_data.num = MPFS_CCC_NUM_CLKS;
 	clk_data->dev = &pdev->dev;
 
 	ret = mpfs_ccc_register_plls(clk_data->dev, mpfs_ccc_pll_clks,
-- 
2.53.0

Re: [PATCH v1] clk: microchip: mpfs-ccc: fix peripheral driver registration failures after oob fix

[Brian Masney]

On Thu, Apr 30, 2026 at 07:30:28PM +0100, Conor Dooley wrote:
> From: Conor Dooley <conor.dooley@microchip.com>
> 
> Commit 2f7ae8ab6aa73 ("clk: microchip: mpfs-ccc: fix out of bounds
> access during output registration") fixed the out of bounds access, but
> it did so by packing sparse indices into a linear space. When
> peripheral drivers request clocks, they obviously don't care for this
> compression and use the sparse indices, and therefore try to request the
> wrong clocks or clocks that don't exist.
> 
> The most straightforward fix here seems to stop being clever with the
> packing and just overallocate the array.
> 
> Fixes: 2f7ae8ab6aa73 ("clk: microchip: mpfs-ccc: fix out of bounds access during output registration")
> Fixes: d39fb172760e ("clk: microchip: add PolarFire SoC fabric clock support")
> Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
> ---
> CC: Daire McNamara <daire.mcnamara@microchip.com>
> CC: Michael Turquette <mturquette@baylibre.com>
> CC: Stephen Boyd <sboyd@kernel.org>
> CC: Brian Masney <bmasney@redhat.com>
> CC: Claudiu Beznea <claudiu.beznea@tuxon.dev>
> CC: linux-riscv@lists.infradead.org
> CC: linux-clk@vger.kernel.org
> CC: linux-kernel@vger.kernel.org
> ---
>  drivers/clk/microchip/clk-mpfs-ccc.c | 15 ++++-----------
>  1 file changed, 4 insertions(+), 11 deletions(-)
> 
> diff --git a/drivers/clk/microchip/clk-mpfs-ccc.c b/drivers/clk/microchip/clk-mpfs-ccc.c
> index 0a76a1aaa50f7..40c17593e5941 100644
> --- a/drivers/clk/microchip/clk-mpfs-ccc.c
> +++ b/drivers/clk/microchip/clk-mpfs-ccc.c
> @@ -32,6 +32,7 @@
>  #define MPFS_CCC_FIXED_DIV		4
>  #define MPFS_CCC_OUTPUTS_PER_PLL	4
>  #define MPFS_CCC_REFS_PER_PLL		2
> +#define MPFS_CCC_NUM_CLKS		16
>  
>  struct mpfs_ccc_data {
>  	void __iomem **pll_base;
> @@ -178,7 +179,7 @@ static int mpfs_ccc_register_outputs(struct device *dev, struct mpfs_ccc_out_hw_
>  			return dev_err_probe(dev, ret, "failed to register clock id: %d\n",
>  					     out_hw->id);
>  
> -		data->hw_data.hws[out_hw->id - 2] = &out_hw->divider.hw;
> +		data->hw_data.hws[out_hw->id] = &out_hw->divider.hw;
>  	}
>  
>  	return 0;
> @@ -231,17 +232,9 @@ static int mpfs_ccc_probe(struct platform_device *pdev)
>  {
>  	struct mpfs_ccc_data *clk_data;
>  	void __iomem *pll_base[ARRAY_SIZE(mpfs_ccc_pll_clks)];
> -	unsigned int num_clks;
>  	int ret;
>  
> -	/*
> -	 * If DLLs get added here, mpfs_ccc_register_outputs() currently packs
> -	 * sparse clock IDs in the hws array
> -	 */
> -	num_clks = ARRAY_SIZE(mpfs_ccc_pll_clks) + ARRAY_SIZE(mpfs_ccc_pll0out_clks) +
> -		   ARRAY_SIZE(mpfs_ccc_pll1out_clks);
> -
> -	clk_data = devm_kzalloc(&pdev->dev, struct_size(clk_data, hw_data.hws, num_clks),
> +	clk_data = devm_kzalloc(&pdev->dev, struct_size(clk_data, hw_data.hws, MPFS_CCC_NUM_CLKS),
>  				GFP_KERNEL);
>  	if (!clk_data)
>  		return -ENOMEM;
> @@ -255,7 +248,7 @@ static int mpfs_ccc_probe(struct platform_device *pdev)
>  		return PTR_ERR(pll_base[1]);
>  
>  	clk_data->pll_base = pll_base;
> -	clk_data->hw_data.num = num_clks;
> +	clk_data->hw_data.num = MPFS_CCC_NUM_CLKS;
>  	clk_data->dev = &pdev->dev;
>  
>  	ret = mpfs_ccc_register_plls(clk_data->dev, mpfs_ccc_pll_clks,

Reviewed-by: Brian Masney <bmasney@redhat.com>

I confirmed that there are 16 clock IDs defined at the bottom of
include/dt-bindings/clock/microchip,mpfs-clock.h.

Brian